You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/util
Andrew Lytvynov 6abb425482
ipn/ipnauth: improve the Windows token administrator check (#10755)
(*Token).IsAdministrator is supposed to return true even when the user is
running with a UAC limited token. The idea is that, for the purposes of
this check, we don't care whether the user is *currently* running with
full Admin rights, we just want to know whether the user can
*potentially* do so.

We accomplish this by querying for the token's "linked token," which
should be the fully-elevated variant, and checking its group memberships.

We also switch ipn/ipnserver/(*Server).connIsLocalAdmin to use the elevation
check to preserve those semantics for tailscale serve; I want the
IsAdministrator check to be used for less sensitive things like toggling
auto-update on and off.

Updates tailscale/corp#15405

Signed-off-by: Aaron Klotz <aaron@tailscale.com>
Co-authored-by: Aaron Klotz <aaron@tailscale.com>
2 years ago
..
cibuild all: update copyright and license headers 3 years ago
clientmetric util/clientmetric: allow client metric values to be provided by a function 3 years ago
cloudenv all: update copyright and license headers 3 years ago
cmpver all: update copyright and license headers 3 years ago
cmpx util/cmpx: add package with cmp-like things from future Go releases 3 years ago
codegen util/codegen: support embedded fields 3 years ago
cstruct all: update copyright and license headers 3 years ago
deephash tailcfg: make SelfNodeV4MasqAddrForThisPeer a pointer 3 years ago
dirwalk all: use tstest.Replace more 3 years ago
dnsname cmd/tailscale: extend hostname validation (#7678) 3 years ago
goroutines all: update copyright and license headers 3 years ago
groupmember all: update copyright and license headers 3 years ago
hashx all: update copyright and license headers 3 years ago
httpm all: update copyright and license headers 3 years ago
jsonutil all: update copyright and license headers 3 years ago
lineread all: update copyright and license headers 3 years ago
linuxfw all: use cmpx.Or where it made sense 3 years ago
mak various: add golangci-lint, fix issues (#7905) 3 years ago
multierr util/multierr: implement Go 1.20+'s multiple error Unwrap 3 years ago
must all: update copyright and license headers 3 years ago
osshare all: update copyright and license headers 3 years ago
pidowner all: update copyright and license headers 3 years ago
precompress all: update copyright and license headers 3 years ago
quarantine all: update copyright and license headers 3 years ago
racebuild all: update copyright and license headers 3 years ago
ringbuffer util/ringbuffer: move generic ringbuffer from corp repo 3 years ago
set util/set: add a basic map-based Set type 3 years ago
singleflight all: update copyright and license headers 3 years ago
slicesx util/slicesx: add Partition function 3 years ago
sysresources util/sysresources, magicsock: scale DERP buffer based on system memory 3 years ago
systemd all: update copyright and license headers 3 years ago
truncate util: add truncate package (#7490) 3 years ago
uniq all: update copyright and license headers 3 years ago
vizerror util/vizerror: add As function to get wrapped Error 3 years ago
winutil ipn/ipnauth: improve the Windows token administrator check (#10755) 2 years ago